Provide a DSAR intake form or API endpoint that captures the requester's email and an identity-verification token; use an existing account credential (login session, MFA confirmation, or email OTP) to verify identity rather than collecting new sensitive documents, keeping to data minimization principles.
Record the receipt timestamp; GDPR Art. 12 requires you respond without undue delay and at the latest within one calendar month; set an automated reminder at day 20 to flag requests approaching the deadline.
Query all systems holding personal data for that data subject — user profile DB, analytics warehouse, CRM, support ticketing — and aggregate the results into a structured response covering: categories of data, purposes, recipients or categories of recipients, retention periods, and any automated decision-making logic per Art. 15(1).
Package the response as a machine-readable export (JSON or CSV) plus a human-readable summary; for large datasets, extension of up to two additional months is permitted if you notify the data subject within the first month and explain the complexity.
Deliver the response via a secure channel (authenticated download link or encrypted email attachment); avoid attaching the full data dump to an unencrypted reply-all email thread.
Record completion in your DSAR log with the request ID, identity verification method, response date, and whether an extension was invoked, to demonstrate accountability under Art. 5(2).
Known gotchas
GDPR does not specify an identity verification method but Recital 64 requires all reasonable measures; requesting a government ID copy may violate data minimization if simpler verification (e.g., authenticated session) is feasible.
The one-month clock starts when the controller receives the request, regardless of whether identity verification is pending — if you need ID before proceeding, notify the requester promptly that the clock is paused pending verification, as ICO guidance permits pausing only when identity is genuinely in doubt.
Improperly disclosing another person's data in response to a fraudulent access request is itself a data breach reportable under GDPR Art. 33; invest in robust identity verification proportionate to the sensitivity of the data held.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp